@pellux/goodvibes-tui 2.0.21 → 2.1.1

package/src/shell/transcript-scroll.ts

@@ -0,0 +1,68 @@
+/**
+ * transcript-scroll.ts, where the main transcript is scrolled to.
+ *
+ *   top      the first transcript line on screen
+ *   locked   parked at the live bottom: each frame follows the tail
+ *
+ * Scrolling up (the mouse wheel, PageUp, Up past the input history) unlocks
+ * it; reaching the bottom again, Esc (handler-modal-stack.ts), or submitting
+ * input locks it again. While it is unlocked the back-to-bottom pill shows
+ * above the input area (back-to-bottom.ts) and Esc returns to the bottom
+ * instead of interrupting the running turn.
+ */
+
+export class TranscriptScroll {
+  /** The first transcript line on screen. */
+  top = 0;
+  /** Parked at the live bottom, following the tail. */
+  locked = true;
+  /** The clamp the last frame computed (overlay- and footer-aware); null before the first frame. */
+  private lastMax: number | null = null;
+
+  /** Away from the live bottom: the pill shows and Esc goes back down. */
+  get scrolledBack(): boolean {
+    return !this.locked;
+  }
+
+  /**
+   * Scroll by `delta` lines (negative is up). `fallbackMax` is used only
+   * before the first frame has computed the real clamp.
+   */
+  scrollBy(delta: number, fallbackMax: () => number): void {
+    const max = this.lastMax ?? fallbackMax();
+    this.top = Math.max(0, Math.min(this.top + delta, max));
+    this.locked = this.top >= max;
+  }
+
+  /** Back to the live bottom: the next frame follows the tail again. */
+  toBottom(): void {
+    this.locked = true;
+  }
+
+  /** Show `line` at the top (a bookmark, a search hit); unlocks unless that is the bottom. */
+  jumpTo(line: number, max?: number): void {
+    this.locked = false;
+    this.top = Math.max(0, max === undefined ? line : Math.min(line, max));
+  }
+
+  /** Follow the tail while locked (the stream path). */
+  followTail(lineCount: number, viewportHeight: number): void {
+    if (!this.locked) return;
+    this.top = Math.max(0, lineCount - viewportHeight);
+  }
+
+  /**
+   * Take the frame's clamp. Unlocked but already at the bottom (a jump that
+   * landed there, output that shrank) is the live bottom: lock again.
+   * Returns true when that re-lock happened.
+   */
+  settle(nextTop: number, maxScroll: number): boolean {
+    this.top = nextTop;
+    this.lastMax = maxScroll;
+    if (!this.locked && nextTop >= maxScroll) {
+      this.locked = true;
+      return true;
+    }
+    return false;
+  }
+}

package/src/shell/ui-openers.ts

@@ -1,9 +1,11 @@
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { openModelPickerNow, type ModelPickerOpenDeps } from '../input/model-picker-open.ts';
 import { getProviderIdFromModel } from '@pellux/goodvibes-sdk/platform/providers';
-import type { ConversationManager } from '../core/conversation';
 import type { CommandContext } from '../input/command-registry.ts';
 import type { InputHandler } from '../input/handler.ts';
-import type { PanelManager } from '../panels/panel-manager.ts';
+import type { ShellViews } from '../views/builtin-views.ts';
+import type { ViewPanelAdapter } from '../views/view-panel-adapter.ts';
+import { wireViewOpeners } from './view-openers.ts';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
@@ -13,11 +15,14 @@ import type { SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { MemoryEmbeddingProviderRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { ServiceInspectionQuery } from '@/runtime/index.ts';
 import type { EmbeddingProviderPickerEntry, ModelPickerTargetInfo } from '../input/model-picker.ts';
-import type { SelectionItem } from '../input/selection-modal.ts';
+import { CommandPalette, buildPaletteEntries } from '../input/command-palette.ts';
+import { confirmThrough } from '../input/confirm-dialog.ts';
+import { bridgeNotificationFeedToToasts, getSharedToastCenter } from '../renderer/toast-center.ts';
+import { getSharedNotificationFeed } from '../views/notifications-feed.ts';
 import { categorizeBuiltinCommands } from '../input/commands.ts';
 import { syncServiceSettingToPlatform } from './service-settings-sync.ts';
-import { setActiveThemeMode } from '../renderer/theme.ts';
-import { THEME_MODE_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
+import { setActiveThemeMode, setActiveThemeName } from '../renderer/theme.ts';
+import { THEME_MODE_CONFIG_KEY, THEME_NAME_CONFIG_KEY, coerceThemeModeSetting } from '../renderer/theme-mode-config.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { buildFirstOpenItems, decodeFirstOpenChoice, selfRecordWorkspaceRegistration } from '../cli/tui-startup.ts';
 import type { SettingsDaemonCredentialWriter } from '../input/settings-modal-secrets.ts';
@@ -27,8 +32,10 @@ import type { WorkspaceTrustLevel } from '@pellux/goodvibes-sdk/platform/runtime
 type WireShellUiOpenersOptions = {
   commandContext: CommandContext;
   input: InputHandler;
-  panelManager: PanelManager;
-  conversation: ConversationManager;
+  /** The read models and config-modal surfaces behind the built-in modals. */
+  views: ShellViews;
+  /** The operator API's panels.list / panels.open, answered by the modal views. */
+  viewPanelAdapter: ViewPanelAdapter;
   configManager: ConfigManager;
   providerRegistry: ProviderRegistry;
   runtime: MutableRuntimeState;
@@ -125,8 +132,8 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   const {
     commandContext,
     input,
-    panelManager,
-    conversation,
+    views,
+    viewPanelAdapter,
     configManager,
     providerRegistry,
     runtime,
@@ -284,70 +291,39 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     ];
   };
 
-  commandContext.openModelPicker = () => {
-    // Picker-open re-check: re-verify each provider's live model list (TTL-
-    // respecting) so a freshly-opened picker reflects models the provider
-    // started or stopped serving. Fire-and-forget; a completed refresh re-renders
-    // so the list updates in place without blocking the open.
-    void providerRegistry.refreshLiveModelDiscovery?.().then((reports) => {
-      if (reports.some((report) => report.added.length > 0 || report.removed.length > 0)) render();
-    }).catch(() => {});
-    void (async () => {
-      // getSelectableModels() is catalog-driven and can list models whose
-      // `provider` id (e.g. 'google', sourced from the pricing catalog) was never
-      // handed to providerRegistry.register()/registerRuntimeProvider(). Selecting
-      // such a model fails hard at turn time with ProviderNotFoundError
-      // ("Provider 'X' is not registered."). Filter to runtime-registered
-      // providers only, so the picker never offers a model that cannot work.
-      const models = providerRegistry.getSelectableModels().filter((m) => providerRegistry.has(m.provider));
-      const configuredIds = new Set(getConfiguredProviderIds());
-      input.modelPicker.configuredProviders = configuredIds;
-      const providerIds = [...new Set(models.map((m) => m.provider))];
-      const secretProviderIds = await resolveSecretProviderIds();
-      input.modelPicker.configuredViaMap = buildConfiguredViaMap(providerIds, configuredIds, subscriptionManager, secretProviderIds);
-      void getPinned().then((pinned) => {
-        input.modelPicker.pinnedIds = new Set(pinned);
-      });
-      void input.modelPicker.loadRecentModels().catch(() => {}); // best-effort: prefetch for UI, failure is non-visible
-      const embeddingEntries = await resolveEmbeddingProviderEntries();
-      input.modelPicker.embeddingProviders = embeddingEntries;
-      input.modalOpened('modelPicker');
-      input.modelPicker.setTargetInfos(buildModelPickerTargets(embeddingEntries));
-      input.modelPicker.openAllModels(models, getCurrentModelForPickerTarget());
-      render();
-    })().catch((error: unknown) => {
-      commandContext.print?.(`Model picker failed to open: ${summarizeError(error)}`);
-      render();
-    });
+  // The picker opens at once on the cached catalog; the credential-source
+  // reads, the embeddings probe and the live model re-check fill in after
+  // (input/model-picker-open.ts). getSelectableModels() and listModels() can
+  // name catalog providers this runtime never registered; both lists keep
+  // runtime-registered providers only, so the picker never offers a model
+  // that fails with "Provider not registered" at turn time.
+  const pickerOpenDeps: ModelPickerOpenDeps = {
+    picker: input.modelPicker,
+    modalOpened: () => input.modalOpened('modelPicker'),
+    render,
+    listModels: () => providerRegistry.getSelectableModels().filter((m) => providerRegistry.has(m.provider)),
+    listProviders: () => [...new Set(providerRegistry.listModels().map((m) => m.provider))].filter((id) => providerRegistry.has(id)),
+    currentModelId: getCurrentModelForPickerTarget,
+    currentProviderId: getCurrentProviderForPickerTarget,
+    configuredProviderIds: () => new Set(getConfiguredProviderIds()),
+    buildConfiguredVia: (ids, configured, secretIds) => buildConfiguredViaMap([...ids], new Set(configured), subscriptionManager, secretIds),
+    buildTargets: buildModelPickerTargets,
+    resolveSecretProviderIds,
+    resolveEmbeddingProviders: resolveEmbeddingProviderEntries,
+    refreshLiveModels: async () => ((await providerRegistry.refreshLiveModelDiscovery?.()) ?? []).some((r) => r.added.length > 0 || r.removed.length > 0),
+    prefetch: async () => {
+      input.modelPicker.pinnedIds = new Set(await getPinned());
+      await input.modelPicker.loadRecentModels();
+    },
+    onError: (error) => { commandContext.print?.(`Model picker could not load everything: ${summarizeError(error)}`); render(); },
   };
 
+  commandContext.openModelPicker = () => { void openModelPickerNow(pickerOpenDeps, 'models'); };
+
   commandContext.openModelPickerWithTarget = (target) => input.openModelPickerWithTarget(target);
   commandContext.openProviderModelPickerWithTarget = (target) => input.openProviderModelPickerWithTarget(target);
 
-  commandContext.openProviderPicker = () => {
-    void (async () => {
-      // listModels() surfaces every catalog provider id, not just the ones
-      // actually registered on this runtime (see openModelPicker above for the
-      // same class of bug). Intersect against providerRegistry.has() so the
-      // provider picker never offers a provider that will fail with
-      // "Provider not registered" once a model under it is selected.
-      const providers = [...new Set(providerRegistry.listModels().map((model) => model.provider))]
-        .filter((providerId) => providerRegistry.has(providerId));
-      const configuredIds = new Set(getConfiguredProviderIds());
-      input.modelPicker.configuredProviders = configuredIds;
-      const secretProviderIds = await resolveSecretProviderIds();
-      input.modelPicker.configuredViaMap = buildConfiguredViaMap(providers, configuredIds, subscriptionManager, secretProviderIds);
-      const embeddingEntries = await resolveEmbeddingProviderEntries();
-      input.modelPicker.embeddingProviders = embeddingEntries;
-      input.modalOpened('modelPicker');
-      input.modelPicker.setTargetInfos(buildModelPickerTargets(embeddingEntries));
-      input.modelPicker.openProviders(providers, getCurrentProviderForPickerTarget());
-      render();
-    })().catch((error: unknown) => {
-      commandContext.print?.(`Provider picker failed to open: ${summarizeError(error)}`);
-      render();
-    });
-  };
+  commandContext.openProviderPicker = () => { void openModelPickerNow(pickerOpenDeps, 'providers'); };
 
   commandContext.completeEmbeddingProviderSelection = (providerId: string) => {
     try {
@@ -382,6 +358,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     if (!input.helpOverlayActive) input.modalOpened('help');
     input.helpOverlayActive = !input.helpOverlayActive;
     input.helpScrollOffset = 0;
+    input.overlayFilters.help.clear();
     render();
   };
 
@@ -398,6 +375,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     if (!input.shortcutsOverlayActive) input.modalOpened('shortcuts');
     input.shortcutsOverlayActive = !input.shortcutsOverlayActive;
     input.shortcutsScrollOffset = 0;
+    input.overlayFilters.shortcuts.clear();
     render();
   };
 
@@ -427,6 +405,12 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
       onSettingApplied: (change) => {
         // forced dark/light applies immediately (rebuild palettes + full
         // repaint); auto only re-probes at startup, so it takes effect next launch.
+        if (String(change.key) === THEME_NAME_CONFIG_KEY) {
+          // Theme changes apply immediately: rebuild palettes + full repaint.
+          const applied = setActiveThemeName(change.value);
+          commandContext.requestFullRepaint?.();
+          return { message: `Theme: ${applied} (applied now)` };
+        }
         if (String(change.key) === THEME_MODE_CONFIG_KEY) {
           const next = coerceThemeModeSetting(change.value);
           if (next === 'dark' || next === 'light') {
@@ -446,15 +430,14 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  // (the purge): open a MIGRATE-TO-MODAL surface by name. Fed from both
-  // ctx.openModal(name) (migrated command front-doors) and PanelManager's
-  // open()-time modal-redirect callback (a legacy panel id resolving to a modal
-  // name). Surfaces are registered in builtin-modals.ts; a name with no
-  // registered surface degrades honestly to a print rather than a blank modal.
+  // Open a config-modal surface by name (or by an old name that redirects to
+  // one, e.g. 'accounts' opens 'providers-modal'). Surfaces are registered in
+  // builtin-modals.ts; a name with no registered surface degrades honestly to
+  // a print rather than a blank modal.
   // The stack name is the stable 'config' slot (one config modal at a time,
   // opening another swaps the surface), so Esc close/return and the modal-stack
   // machinery need only the single 'config' case (handler-ui-state.ts).
-  // Some panel-id redirects (and migrated front-doors) resolve to a NATIVE
+  // Some legacy view-name redirects (and migrated front-doors) resolve to a NATIVE
   // modal that is not a ConfigModalSurface, e.g. `sessions` -> `sessionPicker`,
   // where 'sessionPicker' is the real session-picker modal opened by
   // commandContext.openSessionPicker below, NOT a registered config surface.
@@ -475,7 +458,8 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
       openNative();
       return;
     }
-    const surface = panelManager.getModalSurface(name);
+    const registry = views.modalSurfaces;
+    const surface = registry.getModalSurface(name) ?? registry.getModalSurface(registry.getModalRedirect(name) ?? '');
     if (!surface) {
       commandContext.print(`'${name}' is not available yet in this build.`);
       render();
@@ -485,7 +469,6 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     input.configModal.open(surface, render);
     render();
   };
-  panelManager.setOpenModalCallback(commandContext.openModal);
 
   commandContext.openMcpWorkspace = () => {
     input.openMcpWorkspace(commandContext);
@@ -498,124 +481,53 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
     render();
   };
 
-  commandContext.openPanelPicker = () => {
-    // Focus ownership lives in PanelManager (focusTarget); read it there rather
-    // than tracking a parallel input.panelFocused flag. Toggle semantics: if the
-    // workspace is visible AND already focused, hide it; otherwise reveal and
-    // focus it (opening a picker when nothing is open yet).
-    if (panelManager.isVisible() && panelManager.getFocusTarget() === 'panel') {
-      panelManager.hide();
-      panelManager.focusPrompt();
-      conversation.setSplashSuppressed(false);
-      conversation.rebuildHistory();
-      render();
-      return;
-    }
-    if (panelManager.getAllOpen().length === 0) {
-      // (the purge): 'panel-list' (a browse-all-panels picker PANEL)
-      // was DELETE-disposition, a picker over a handful of panels is dead
-      // weight now. Its replacement is this selection MODAL, built from the
-      // live registry (PanelManager.getRegisteredTypes()) rather than a
-      // hardcoded list, so it can never list a retired/deleted id.
-      const items: SelectionItem[] = panelManager.getRegisteredTypes().map((entry) => ({
-        id: entry.id,
-        label: `${entry.icon} ${entry.name}`,
-        detail: entry.description,
-        category: entry.category,
-        primaryAction: 'select',
-      }));
-      commandContext.openSelection?.('Open Panel', items, { allowSearch: true }, (result) => {
-        if (!result) return;
-        panelManager.open(result.item.id);
-        panelManager.show();
-        panelManager.focusPanels();
-        conversation.setSplashSuppressed(true);
-        conversation.rebuildHistory();
-        render();
-      });
-      return;
-    }
-    panelManager.show();
-    panelManager.focusPanels();
-    conversation.setSplashSuppressed(true);
-    conversation.rebuildHistory();
-    render();
-  };
-
   // Registry-driven surfaces built inside command handlers (/help) group by
   // the same categories as the palette and the generated reference.
   commandContext.getCommandCategories = () => getCommandCategoryMap();
 
+  input.surfaceModals.onChange = render;
+  commandContext.confirm = (options) => confirmThrough(input.surfaceModals, options);
+  const toasts = getSharedToastCenter();
+  toasts.onChange = render;
+  commandContext.showToast = (toast) => toasts.show(toast);
+  bridgeNotificationFeedToToasts(getSharedNotificationFeed(), toasts);
+
   commandContext.openCommandPalette = () => {
     // The palette is built live from the command registry, never a hardcoded
     // list, so it can never drift from the real command set. Category labels
     // come from the same source the generated docs use (getCommandCategoryMap).
     const registry = input.commandRegistry;
     if (!registry) return;
-    const categoryByName = getCommandCategoryMap();
-    const items: SelectionItem[] = registry
-      .getAll()
-      .slice()
-      .sort((a, b) => a.name.localeCompare(b.name))
-      .map((cmd) => {
-        const argsHint = cmd.argsHint ?? cmd.usage;
-        const detailParts: string[] = [];
-        if (cmd.description) detailParts.push(cmd.description);
-        if (argsHint) detailParts.push(`(args: ${argsHint})`);
-        if ((cmd.aliases ?? []).length > 0) detailParts.push(`[aka ${(cmd.aliases ?? []).map((a) => `/${a}`).join(', ')}]`);
-        return {
-          id: cmd.name,
-          label: `/${cmd.name}`,
-          detail: detailParts.join(' '),
-          category: categoryByName.get(cmd.name) ?? 'Other',
-          primaryAction: 'select' as const,
-        };
-      });
-    commandContext.openSelection?.(
-      'Command Palette',
-      items,
-      { allowSearch: true, primaryVerbLabel: 'Run' },
-      (result) => {
-        if (!result) return;
-        const cmd = registry.get(result.item.id);
-        if (!cmd) return;
-        // Pre-fill the composer with the command (and a trailing space so the
-        // inline args hint shows what the command wants). Keyboard-first: focus
-        // returns to the composer with command mode armed so the user fills any
-        // args and presses Enter, matching tab-completion's fill behavior.
-        input.prompt = `/${cmd.name} `;
+    const top = input.surfaceModals.top();
+    if (top instanceof CommandPalette) return;
+    const palette = new CommandPalette({
+      entries: buildPaletteEntries(registry.getAll(), getCommandCategoryMap()),
+      describe: (id) => (id === 'model' ? commandContext.session.runtime.model || undefined : undefined),
+      onRun: (entry, mode) => {
+        if (mode === 'run' && commandContext.executeCommand) {
+          void commandContext.executeCommand(entry.id, []).finally(() => render());
+          return;
+        }
+        // Fill the composer with the command (and a trailing space so the
+        // inline args hint shows what the command wants), command mode armed,
+        // so the user types any arguments and presses Enter, matching
+        // tab-completion's fill behavior.
+        input.prompt = `/${entry.id} `;
         input.cursorPos = input.prompt.length;
         input.commandMode = true;
         input.autocomplete?.reset();
         commandContext.focusPrompt?.();
         render();
       },
-    );
-  };
-
-  commandContext.focusPanels = () => {
-    panelManager.focusPanels();
+    });
+    input.surfaceModals.push(palette);
     render();
   };
 
   commandContext.focusPrompt = () => {
-    panelManager.focusPrompt();
     input.indicatorFocused = false;
     render();
   };
 
-  commandContext.showPanel = (panelId, pane, target, opts) => {
-    // forward the deep-link target so a jumped-to panel lands on the
-    // right row (fleet --target); undefined for ordinary opens.
-    panelManager.open(panelId, pane, target);
-    panelManager.show();
-    // focus rule 1a: every registered caller of showPanel is a slash
-    // command (/panel open, /routes, /approval, /tasks, /ops-control, ...),
-    // the command path leaves focus in the composer ("the user is
-    // mid-command-flow") unless the caller explicitly asks to grab it.
-    if (opts?.focus) panelManager.focusPanels();
-    conversation.setSplashSuppressed(true);
-    conversation.rebuildHistory();
-    render();
-  };
+  wireViewOpeners({ commandContext, input, views, viewPanelAdapter, render });
 }

package/src/shell/view-openers.ts

@@ -0,0 +1,205 @@
+/**
+ * view-openers.ts, the openers for the built-in modals: Agents, Usage,
+ * Changes (and its previews), Notifications and the local-auth password
+ * prompt, plus ctx.openView, which turns any current or old view name
+ * ('fleet', 'cockpit', 'tokens', 'git', 'providers', …) into the modal that
+ * holds it now (input/views.ts).
+ *
+ * Every modal is a kit SurfaceModal pushed on the input handler's modal host.
+ * Opening one that is already open brings it to the top instead of stacking a
+ * second copy.
+ */
+
+import type { CommandContext } from '../input/command-registry.ts';
+import type { InputHandler } from '../input/handler.ts';
+import type { SurfaceModal } from '../input/surface-modal-host.ts';
+import type { ShellViews } from '../views/builtin-views.ts';
+import type { ViewPanelAdapter } from '../views/view-panel-adapter.ts';
+import { AgentsModal } from '../input/agents-modal.ts';
+import { UsageModal } from '../input/usage-modal.ts';
+import { ChangesModal, type ChangesDeps } from '../input/changes-modal.ts';
+import { NotificationsModal } from '../input/notifications-modal.ts';
+import { MaskedEntryModal } from '../input/masked-entry-modal.ts';
+import { confirmThrough } from '../input/confirm-dialog.ts';
+import { resolveViewName, type ViewTarget } from '../input/views.ts';
+import { getSharedNotificationFeed } from '../views/notifications-feed.ts';
+import { getSharedHostedSessionFeed } from '../views/hosted-session-feed.ts';
+import { revertReviewHunk } from '../input/commands/review-runtime.ts';
+
+export interface WireViewOpenersOptions {
+  readonly commandContext: CommandContext;
+  readonly input: InputHandler;
+  readonly views: ShellViews;
+  readonly viewPanelAdapter: ViewPanelAdapter;
+  readonly render: () => void;
+}
+
+/** Split a preview text into a diff and a note: `@@ label @@\n text` is a note, not a hunk. */
+function previewParts(text: string): { diff: string | null; note: string | null } {
+  const first = text.split('\n', 1)[0] ?? '';
+  if (/^@@ (?!-)/.test(first)) return { diff: null, note: text.slice(first.length + 1).trim() || null };
+  return { diff: text, note: null };
+}
+
+export function wireViewOpeners(options: WireViewOpenersOptions): void {
+  const { commandContext, input, views, viewPanelAdapter, render } = options;
+  const host = input.surfaceModals;
+
+  const findOpen = <T extends SurfaceModal>(type: abstract new (...args: never[]) => T): T | undefined =>
+    host.modals().find((modal): modal is T => modal instanceof type);
+
+  const show = (modal: SurfaceModal): void => {
+    host.push(modal);
+    render();
+  };
+
+  // ── Agents ────────────────────────────────────────────────────────────────
+  commandContext.openAgents = (opts = {}) => {
+    const modal = findOpen(AgentsModal) ?? new AgentsModal({
+      readModel: views.fleet.readModel,
+      actions: views.fleet.actions,
+      acts: views.fleet.acts,
+      spawn: views.fleet.spawn,
+      configManager: views.configManager,
+      hosted: getSharedHostedSessionFeed(),
+      steerHosted: (text) => { void commandContext.executeCommand?.('hosted', ['say', ...text.split(/\s+/)]); },
+      sessionCost: () => {
+        const cost = views.usage.sessionCost();
+        return cost.priced ? cost.usd : null;
+      },
+      confirm: (confirmOptions) => confirmThrough(host, confirmOptions),
+      requestRender: render,
+      openSessionView: (target) => commandContext.openSessionView?.(target) ?? false,
+    });
+    if (opts.target) modal.reveal(opts.target);
+    if (opts.hosted) modal.showHosted();
+    show(modal);
+  };
+
+  // ── Usage ─────────────────────────────────────────────────────────────────
+  commandContext.openUsage = (opts = {}) => {
+    const existing = findOpen(UsageModal);
+    if (existing) {
+      if (opts.tab) existing.tab = opts.tab;
+      show(existing);
+      return;
+    }
+    show(new UsageModal({
+      tracker: views.usage,
+      tab: opts.tab,
+      compact: () => { void commandContext.executeCommand?.('compact', []).finally(render); },
+      requestRender: render,
+    }));
+  };
+  // A click on the footer's token or context row opens Usage.
+  input.onFooterTarget = (target) => {
+    if (target === 'usage') commandContext.openUsage?.();
+  };
+
+  // ── Changes ───────────────────────────────────────────────────────────────
+  const changesDeps: ChangesDeps = {
+    workingDirectory: views.workingDirectory,
+    getSessionFiles: views.getSessionFiles,
+    requestRender: render,
+    submitInput: (text) => commandContext.submitInput?.(text),
+    openInEditor: (path, line) => commandContext.openFileInEditor?.(path, line),
+    revertHunk: (hunk) => revertReviewHunk(commandContext, hunk),
+    confirm: (confirmOptions) => confirmThrough(host, confirmOptions),
+  };
+  // One workspace for the session: reviewed marks and attached comments survive closing it.
+  const workspace = new ChangesModal(changesDeps, 'workspace');
+  commandContext.openChanges = (opts = {}) => {
+    show(workspace);
+    void workspace.reload(opts.source ?? workspace.source);
+  };
+
+  const preview = (title: string, text: string | null, note: string | null): ChangesModal => {
+    const modal = new ChangesModal(changesDeps, 'preview');
+    const parts = text ? previewParts(text) : { diff: null, note: null };
+    modal.loadPreview(title, parts.diff, note ?? parts.note);
+    show(modal);
+    return modal;
+  };
+  commandContext.previewChanges = async (opts) => {
+    const modal = preview(opts.title, opts.diff ?? null, opts.note ?? null);
+    if (!opts.question) return false;
+    return modal.ask(opts.question);
+  };
+
+  // The fleet acts show candidate diffs and ask over them through this.
+  let fleetPreview: ChangesModal | null = null;
+  views.bridge.diffSurface = {
+    show: (title, diff) => {
+      if (fleetPreview) host.close(fleetPreview, 'done');
+      fleetPreview = preview(title, diff, null);
+    },
+    armConfirm: (arm) => {
+      const tone = arm.verb === 'Discard' ? 'danger' as const : 'warning' as const;
+      const asked = fleetPreview && host.modals().includes(fleetPreview)
+        ? fleetPreview.ask({ text: arm.label, confirmLabel: arm.verb, tone })
+        : confirmThrough(host, { title: `${arm.verb}?`, body: arm.label, confirmLabel: arm.verb, tone });
+      void asked.then((ok) => {
+        if (ok) void arm.onConfirm();
+        else arm.onCancel?.();
+        render();
+      });
+    },
+    close: () => {
+      if (fleetPreview) host.close(fleetPreview, 'done');
+      fleetPreview = null;
+      render();
+    },
+  };
+
+  // ── Notifications ─────────────────────────────────────────────────────────
+  const redirect = (name: string): string | undefined => views.modalSurfaces.getModalRedirect(name);
+  commandContext.openNotifications = () => {
+    show(findOpen(NotificationsModal) ?? new NotificationsModal({
+      feed: getSharedNotificationFeed(),
+      resolveSubject: (subject) => (resolveViewName(subject, redirect) ? () => { openView(subject); } : null),
+    }));
+  };
+
+  // ── Local-auth password prompt ────────────────────────────────────────────
+  const openMaskedEntry = (kind: 'add-user' | 'rotate-password', username?: string): void => {
+    show(new MaskedEntryModal({
+      kind,
+      username,
+      auth: views.localUserAuthManager,
+      onDone: (message) => { commandContext.print(message); render(); },
+    }));
+  };
+  views.bridge.openMaskedEntry = openMaskedEntry;
+  commandContext.openLocalAuthMaskedEntry = openMaskedEntry;
+
+  // ── Any view by name ──────────────────────────────────────────────────────
+  const openView = (name: string, target?: ViewTarget): boolean => {
+    const route = resolveViewName(name, redirect);
+    if (!route) return false;
+    switch (route.kind) {
+      case 'agents': commandContext.openAgents?.({ target, hosted: route.hosted }); break;
+      case 'usage': commandContext.openUsage?.({ tab: route.tab }); break;
+      case 'changes': commandContext.openChanges?.({ source: route.mode === 'git' ? 'working' : 'session' }); break;
+      case 'notifications': commandContext.openNotifications?.(); break;
+      case 'sessions': commandContext.openSessionPicker?.(); break;
+      case 'modal': commandContext.openModal?.(route.name); break;
+    }
+    return true;
+  };
+  commandContext.openView = openView;
+  viewPanelAdapter.setOpener((id) => openView(id));
+
+  // The older per-console callbacks commands still call, each onto its modal.
+  commandContext.openForensicsView = () => { openView('forensics'); };
+  commandContext.openIncidentView = () => { openView('incident'); };
+  commandContext.openPolicyView = () => { openView('policy'); };
+  commandContext.openHooksView = () => { openView('hooks'); };
+  commandContext.openCommunicationView = () => { openView('communication'); };
+  commandContext.openOrchestrationView = () => { openView('orchestration'); };
+  commandContext.openCockpitView = () => { openView('cockpit'); };
+  commandContext.openSecurityView = () => { openView('security'); };
+  commandContext.openKnowledgeView = () => { openView('knowledge'); };
+  commandContext.openMemoryView = () => { openView('memory'); };
+  commandContext.openRemoteView = () => { openView('remote'); };
+  commandContext.openSubscriptionView = () => { openView('subscription'); };
+}